Page 5 of 6
Re: Bricked Pam
Posted: 31 Jan 2020, 00:32
by Stevebe
I have just found a second pam am2t midface I’ll pull of eeprom and flash see if it recovers me dead unit then if others want to loan me there Pam modules it would be handy I just need a preface
Re: Bricked Pam
Posted: 31 Jan 2020, 10:48
by DGAlexandru
Stevebe wrote: ↑30 Jan 2020, 16:54RECOVERED FROM AM2T -15K866-AB BRICKED LOADED BS7T -FW IN ERROR-PAM.7z
Do you have the option to save the dump as "entire flash memory" or something like that?
From the file you shared I think you were able to only modify data in "FLASH Page $36".. but because the dump file doesn't contain also the "unused" space between these FLASH Pages, I can't be sure.
HC9S12_DG128.jpg
Also, not being familiar with CG PRO software, I can't be sure how I should create a recovery BIN file for you.
All Mondeo 4 PAM modules use the same SBL so in terms of hardware they all should use at least the same memory regions and CAN communication pins.
Your dump still has the AM2T BootLoader so it should boot in order to be able to communicate with it and flash it with a VBF loader on CAN.
All the FLASH Pages present in your DUMP less FLASH Page $36 have data that is different from the 3 known BS7T FirmWare versions of PAMs, so I think your VBF flashing procedure was able to upload only BS7T-14C377-AA.VBF... which, unfortunately, is exactly how this MCU "learns" on how to communicate on CAN, if we look into the description of the VBF header: "Signal Configuration"... and on Ford server you cannot download your original AM2T-14C377-AA.vbf file.
Comparing your DUMP with 8G92 PAM FW I find many similarities so we can give it a try with FLASH Page $36 from the respective dump.
If we can figure how CG PRO loads a file and then writes it to the Motorola MCU, then we should be able to use the 8G92 and even BS7T dumps that are present on this forum.
PS Your EEPROM dump is OK, so it isn't an EEPROM problem.
Re: Bricked Pam
Posted: 31 Jan 2020, 14:57
by DGAlexandru
In the attached file I did 3 versions for you to try. Test them in the next order:
CGPro_9S12DG128-3L40K_PFLASH_BS7T_Signal_Repaired.BIN - this is your DUMP with one byte modified to have the data in this FLASH Page $36 the same with BS7T-14C377-AA.VBF. This sector also has a CRC16-CITT checksum, which was also different. I think there was a problem when you uploaded this VBF and instead of writing byte "10" it wrote "11". After writing the entire file, the VBF loader program asked for a checksum check and because it saw it was different it stopped the process.
CGPro_9S12DG128-3L40K_PFLASH_8G97_Signal.BIN - your DUMP with FLASH Page $36 modified as you would have uploaded 8G92-14C377-CB.VBF
CGPro_9S12DG128-3L40K_PFLASH_BS7T_FULL.bin - I've created this file from the 2 VBFs for last FW version for PAM BS7T (BS7T-14C090-AD.VBF and BS7T-14C377-AA.VBF) and then added from your DUMP the BootLoader (it cannot be found in a VBF file; it is present in your DUMP and in the other PAM DUMPS present on this forum, almost identical on all; DID "F191" Desc="Vehicle Manufacturer ECU Hardware Number" Data="6G92-14C244-DF")
PAM.7z
If none of them work, then I'll try to do
CGPro_9S12DG128-3L40K_PFLASH_8G92_FULL.bin - FW based on last 8G92 PAM VBFs
Re: Bricked Pam
Posted: 31 Jan 2020, 16:56
by Stevebe
DGAlexandru wrote: ↑31 Jan 2020, 10:48
Stevebe wrote: ↑30 Jan 2020, 16:54RECOVERED FROM AM2T -15K866-AB BRICKED LOADED BS7T -FW IN ERROR-PAM.7z
Do you have the option to save the dump as "entire flash memory" or something like that?
From the file you shared I think you were able to only modify data in "FLASH Page $36".. but because the dump file doesn't contain also the "unused" space between these FLASH Pages, I can't be sure.
HC9S12_DG128.jpg
Also, not being familiar with CG PRO software, I can't be sure how I should create a recovery BIN file for you.
All Mondeo 4 PAM modules use the same SBL so in terms of hardware they all should use at least the same memory regions and CAN communication pins.
Your dump still has the AM2T BootLoader so it should boot in order to be able to communicate with it and flash it with a VBF loader on CAN.
All the FLASH Pages present in your DUMP less FLASH Page $36 have data that is different from the 3 known BS7T FirmWare versions of PAMs, so I think your VBF flashing procedure was able to upload only BS7T-14C377-AA.VBF... which, unfortunately, is exactly how this MCU "learns" on how to communicate on CAN, if we look into the description of the VBF header: "Signal Configuration"... and on Ford server you cannot download your original AM2T-14C377-AA.vbf file.
Comparing your DUMP with 8G92 PAM FW I find many similarities so we can give it a try with FLASH Page $36 from the respective dump.
If we can figure how CG PRO loads a file and then writes it to the Motorola MCU, then we should be able to use the 8G92 and even BS7T dumps that are present on this forum.
PS Your EEPROM dump is OK, so it isn't an EEPROM problem.
Can I ask what software your using , I keep reading the info on the Cgpro it don’t give any options other than read flash or read eeprom,
Is there a better unit and software I can find.
Thank you for all your time and work, the only thing with all the dump files are the eeprom seemed ok and the correct version AM2T
as the unit is a mid face. The mistake I made when I bricked the Pam was I loaded facelift
So reloading these files will it be ok. I did wonder weather I need a flash of the AM2T version..
Is there anything I can send you to help understand the Cgpro...
Kind regards. Steve
Re: Bricked Pam
Posted: 31 Jan 2020, 18:14
by DGAlexandru
I'm using only a HEX editor - HxD .. but I'm used with comparing VBF files with DUMPS so I was able to understand how CG PRO saved that DUMP.
Each FLASH Page of 9S12DG128 MCU has 0x4000 bytes and CG PRO saved them one after another, starting from address 0 in the DUMP file => FLASH Page $30 starts at 0x0 and ends at 0x3FFF; FLASH Page $31 starts at 0x4000 and ends at 0x7FFF and so on.
A "normal" full DUMP in a BIN file preserves the address where the bytes were read from, so the contents of FLASH Page $30 would start at address 0x8000 and end at 0xBFFF, then until the next FLASH Page starts ($31 at 0x018000) we would have "FF" values; FLASH Page $31 would start at address 0x018000 and end at 0x01BFFF, then until the next FLASH Page starts ($32 at 0x028000) we would have again "FF" values.. and so on.
CG PRO is good, it knows many chips and has some extra tools for IMMO. When I'll have some money to spend for such a tool I'll buy one also
For HC912 / 9S12 Motorola MCU Family I'm using an old "HC912 Programmer" from ETL (it works over SERIAL port).
Re: Bricked Pam
Posted: 31 Jan 2020, 18:29
by Stevebe
DGAlexandru wrote: ↑31 Jan 2020, 18:14
CG PRO is good, it knows many chips and has some extra tools for IMMO. When I'll have some money to spend for such a tool I'll buy one also
For HC912 / 9S12 Motorola MCU Family I'm using an old "HC912 Programmer" from ETL (it works over SERIAL port).
I did look at the new ETL but it’s a bit to expensive.. ok I think I understand, it’s quite a hard lerning curve but it’s a stimulating sunject
I have got a working mid face PAM on its way I’ll read that and let you have a look.
From what you said in previous notes did I understand that the cgpro didn’t read all of the flash properly
What was the software you used above to show all the details of the chip.
Re: Bricked Pam
Posted: 31 Jan 2020, 19:03
by DGAlexandru
Not understanding from begining how CG PRO saved the contents of MCU in that bin file, I couldn't be sure if it saved everything, but after I understood the DUMP file it was easy to create a "repair" file for you.
That image is from ETL software. In the left pannel are the MCUs it knows and in the right pannel it gives you the information about EEPROM / FLASH organisation and also where are the bytes for Flash Security.
Re: Bricked Pam
Posted: 31 Jan 2020, 21:20
by Stevebe
[quote=DGAlexandru post_id=1557 time=1580497398 user_id=70]
Not understanding from begining how CG PRO saved the contents of MCU in that bin file, I couldn't be sure if it saved everything, but after I understood the DUMP file it was easy to create a "repair" file for you.
That image is from ETL software. In the left pannel are the MCUs it knows and in the right pannel it gives you the information about EEPROM / FLASH organisation and also where are the bytes for Flash Security.
[/quote
Can i get a copy of that software you use to look at.
i have tried using the HC912 settings although it didnt read the chip id it did read and also read the shadow bytes the eeprom is tottaly different and the flash is simular ..
HC912DG128A-3K91D.7z
Re: Bricked Pam
Posted: 31 Jan 2020, 23:23
by DGAlexandru
Why read it as 912 when the chip is 9S12? They are different!!!
ETL software can be used only with their hardware. The version for old hardware can still be downloaded from their website:
https://www.etlweb.com/soft/hc912prog18.zip
Re: Bricked Pam
Posted: 01 Feb 2020, 00:14
by Stevebe
Whoops just me having a bad day lol
just dealet files my bad